Debian bullseye
Source: Debian Security Tracker
python-urllib3→ fixed in1.26.5-1~exp1+deb11u3urgency: not yet assignedsudo apt-get install --only-upgrade -y python-urllib3
Back to CVE digest
CVE-2026-21441 · cross-distro fix matrix
CVE-2026-21441: urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Co
Affects 6 Linux releases across 6 (distro × package) combinations.
Fix per ecosystem
Each block below is a distro release where CVE-2026-21441 has a known fix. Run the listed command on that distro to remediate.
Debian bookworm
Source: Debian Security Tracker
python-urllib3→ fixed in1.26.12-1+deb12u3urgency: not yet assignedsudo apt-get install --only-upgrade -y python-urllib3
Debian trixie
Source: Debian Security Tracker
python-urllib3→ fixed in2.3.0-3+deb13u1urgency: not yet assignedsudo apt-get install --only-upgrade -y python-urllib3
Alpine v3.20
Source: Alpine secdb
py3-urllib3→ fixed in1.26.18-r2apk update && apk add --upgrade py3-urllib3
Alpine v3.21
Source: Alpine secdb
py3-urllib3→ fixed in1.26.20-r1apk update && apk add --upgrade py3-urllib3
Alpine edge
Source: Alpine secdb
py3-urllib3→ fixed in2.6.3-r0apk update && apk add --upgrade py3-urllib3
Are YOU affected by CVE-2026-21441?
5-second check on your actual server. Reads /etc/os-release, uname -r, and the distro's package manager; matches against this same cross-source index live.
curl https://mindsparkstack.com/scan.sh | bash
Continuous monitoring beats manual checking
CVE-2026-21441dropped silently in your distro's update channel. Every new CVE is the same story. StackPatch runs the matcher hourly against all 5 sources and emails the exact remediation when something new applies to one of your servers. $99 lifetime, 50 founder seats, 30-day refund.
See StackPatch ($99 lifetime)